PAN-OS CVE-2026-0322: Exploited Management Interface RCE
Security

PAN-OS CVE-2026-0322: Exploited Management Interface RCE

PAN-OS CVE-2026-0322 lets an authenticated admin run code as root on PA-Series, VM-Series and Panorama. It is exploited and on CISA KEV.

AB
Anthony Bahn IT Director & Cybersecurity Consultant
palo alto networkspan-oscisa kevmanagement interfacecode injection

Palo Alto Networks disclosed PAN-OS CVE-2026-0322 on 14 October 2026: a code injection flaw in the firewall management interface that lets an authenticated administrator run code as root. The vendor has seen very limited exploitation, and CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 17 October deadline. PA-Series, VM-Series and Panorama are affected. Restrict management access to trusted hosts today, then upgrade to the fixed release for your branch.

What happened

Palo Alto Networks published the advisory on 14 October 2026 under the title "PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface." The flaw is classed as CWE-94, improper control of generation of code. The advisory credits an internal researcher, Suraj Siddharudh, and lists the issue as discovered internally.

The same advisory states that "very limited exploitation has been observed targeting the Palo Alto Networks management interface." It sets the exploit maturity field to ATTACKED and the suggested urgency to HIGHEST.

CISA added CVE-2026-0322 to the KEV catalog on 14 October with a due date of 17 October, three days out. The KEV entry describes a code injection vulnerability that "could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall." CISA marks the entry for forensic triage under BOD 26-04 and lists ransomware use as unknown.

SecurityWeek reports that no threat actor has been named and that Palo Alto Networks published about a dozen other advisories the same day for PAN-OS, GlobalProtect and Prisma Cloud, all rated medium or low. With this addition, the KEV catalog lists 16 Palo Alto Networks vulnerabilities, three of them added this year.

This is the second PAN-OS flaw under active exploitation this week. On 12 October we covered GlobalProtect CVE-2026-0257, an authentication bypass on the portal and gateway. The two bugs sit in different components and need different fixes.

Who is affected

The advisory lists these products as affected:

  • PA-Series hardware firewalls
  • VM-Series virtual firewalls
  • Panorama, both virtual and M-Series appliances

Cloud NGFW and Prisma Access are not affected. The advisory says no special configuration is required to be vulnerable, so every unpatched device on an affected branch is in scope.

Affected branches are 12.2, 12.1, 11.2, 11.1 and 10.2. The first fixed releases per branch are:

  • 12.2: 12.2.4
  • 12.1: 12.1.4-h12, 12.1.7-h8, 12.1.10-h2
  • 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16
  • 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3
  • 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12

The advisory gave 11.2.16 an ETA of 15 October. Confirm it is actually available on the support portal before you schedule an upgrade to it, or use the hotfix release for your current 11.2 minor version. Devices on unsupported PAN-OS versions need to move to a supported fixed release.

How PAN-OS CVE-2026-0322 works

The CVSS 4.0 base score is 8.6 (High), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The advisory also gives 8.5 for the case where management access is limited to a jump box, which changes the attack vector from network to adjacent.

The score is held down by one field: privileges required is High. An attacker needs a valid administrator session on the management interface before the bug is reachable. That is the reason this is not rated critical, and it is also the reason it deserves attention. Exploitation in the wild means someone either held working admin credentials for the targeted devices or reached the interface another way. Neither the advisory nor the KEV entry says which. We explain how to read that field in what CVSS privileges required means for patch triage.

The result of a successful attack is code execution as root on the firewall. Root on a firewall gives control of traffic policy, VPN configuration and any credentials the device stores. On Panorama, the same access reaches every firewall it manages.

Some aggregators label the flaw critical. Use the vendor's own rating: CVSS 4.0 8.6, High, with HIGHEST urgency.

What to do now

  1. Cut off management access. The advisory states that no known workarounds exist, so exposure reduction is the only control before the patch lands. Allow the management interface only from trusted internal addresses, ideally a single jump box. Our guide on how to restrict firewall management access to a jump box walks through the design.
  2. Inventory. List every PA-Series, VM-Series and Panorama device, its PAN-OS version, and whether its management interface answers from any untrusted network. If you need a method for the exposure check, see how to find which admin consoles are reachable from the internet.
  3. Upgrade. Move each device to the fixed release that matches its current minor version, using the solution table in the advisory. Panorama counts.
  4. Turn on the signatures. Threat Prevention subscribers can enable Threat IDs 510046 and 510047, available in Applications and Threats content 9159-10287 or later. The advisory calls this limited coverage and notes it requires SSL decryption of inbound management traffic. It also describes routing management traffic through a data-plane interface with a management profile so the signatures can inspect it.
  5. Hunt. Search firewall and perimeter logs for connections from the three addresses the advisory lists as threat activity: 66.42.72.14, 208.83.239.114 and 149.248.47.234.
  6. Audit admin accounts. Because the bug requires an authenticated administrator, review who holds admin rights on each device, when they last logged in and from where. Why exploited admin-only bugs demand a firewall admin audit covers what to check and why.

If any device had its management interface reachable from the internet before you restricted it, treat it as possibly compromised. Collect logs and a support file before upgrading, since CISA flagged this entry for forensic triage.

What to watch next

  • Whether 11.2.16 ships on the stated 15 October date.
  • Updates to the advisory on attacker infrastructure, or a change in exploitation status from "very limited."
  • Any public statement from Palo Alto Networks or CISA on how attackers obtained the admin access the flaw requires.
  • Public proof-of-concept code. If one appears, expect scanning against exposed management interfaces to rise quickly.

Sources

← Back to all news